<?php
/* $Id$ */
/*
	firewall_rules_edit.php
	part of pfSense (http://www.pfsense.com)
        Copyright (C) 2005 Scott Ullrich (sullrich@gmail.com)

	originally part of m0n0wall (http://m0n0.ch/wall)
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
	All rights reserved.

	Redistribution and use in source and binary forms, with or without
	modification, are permitted provided that the following conditions are met:

	1. Redistributions of source code must retain the above copyright notice,
	   this list of conditions and the following disclaimer.

	2. Redistributions in binary form must reproduce the above copyright
	   notice, this list of conditions and the following disclaimer in the
	   documentation and/or other materials provided with the distribution.

	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	POSSIBILITY OF SUCH DAMAGE.
*/

##|+PRIV
##|*IDENT=page-firewall-rules-edit
##|*NAME=Firewall: Rules: Edit page
##|*DESCR=Allow access to the 'Firewall: Rules: Edit' page.
##|*MATCH=firewall_rules_edit.php*
##|-PRIV


require("guiconfig.inc");

$specialsrcdst = explode(" ", "any wanip lanip lan pptp pppoe");
$lang = array('pass' => '通过', 'block' => '阻止', 'reject' => '拒绝');

if (!is_array($config['filter']['rule'])) {
	$config['filter']['rule'] = array();
}
filter_rules_sort();
$a_filter = &$config['filter']['rule'];

$id = $_GET['id'];
if (is_numeric($_POST['id']))
	$id = $_POST['id'];

$after = $_GET['after'];

if (isset($_POST['after']))
	$after = $_POST['after'];

if (isset($_GET['dup'])) {
	$id = $_GET['dup'];
	$after = $_GET['dup'];
}

if (isset($id) && $a_filter[$id]) {
	$pconfig['interface'] = $a_filter[$id]['interface'];

	if (!isset($a_filter[$id]['type']))
		$pconfig['type'] = "pass";
	else
		$pconfig['type'] = $a_filter[$id]['type'];

	if (isset($a_filter[$id]['floating']) || $if == "FloatingRules") {
		$pconfig['floating'] = $a_filter[$id]['floating'];
		if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "") 
			$pconfig['interface'] = $a_filter[$id]['interface'];
	}
	
	if (isset($a_filter['floating'])) 
		$pconfig['floating'] = "yes";

	if (isset($a_filter[$id]['direction']))
                $pconfig['direction'] = $a_filter[$id]['direction'];

	if (isset($a_filter[$id]['protocol']))
		$pconfig['proto'] = $a_filter[$id]['protocol'];
	else
		$pconfig['proto'] = "any";

	if ($a_filter[$id]['protocol'] == "icmp")
		$pconfig['icmptype'] = $a_filter[$id]['icmptype'];

	address_to_pconfig($a_filter[$id]['source'], $pconfig['src'],
		$pconfig['srcmask'], $pconfig['srcnot'],
		$pconfig['srcbeginport'], $pconfig['srcendport']);

	if($a_filter[$id]['os'] <> "")
		$pconfig['os'] = $a_filter[$id]['os'];

	address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'],
		$pconfig['dstmask'], $pconfig['dstnot'],
		$pconfig['dstbeginport'], $pconfig['dstendport']);

	if ($a_filter[$id]['dscp'] <> "")
		$pconfig['dscp'] = $a_filter[$id]['dscp'];

	$pconfig['disabled'] = isset($a_filter[$id]['disabled']);
	$pconfig['log'] = isset($a_filter[$id]['log']);
	$pconfig['descr'] = $a_filter[$id]['descr'];

	if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "") 
		$pconfig['tag'] = $a_filter[$id]['tag'];
	if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tag'] <> "")
        	$pconfig['tagged'] = $a_filter[$id]['tagged'];
	if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick'])
		$pconfig['quick'] = $a_filter[$id]['quick'];
	if (isset($a_filter[$id]['allowopts']))
		$pconfig['allowopts'] = true;

	/* advanced */
        $pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes'];
        $pconfig['max-src-states'] = $a_filter[$id]['max-src-states'];
        $pconfig['statetype'] = $a_filter[$id]['statetype'];
	$pconfig['statetimeout'] = $a_filter[$id]['statetimeout'];

	$pconfig['nosync'] = isset($a_filter[$id]['nosync']);

	/* advanced - new connection per second banning*/
	$pconfig['max-src-conn-rate'] = $a_filter[$id]['max-src-conn-rate'];
	$pconfig['max-src-conn-rates'] = $a_filter[$id]['max-src-conn-rates'];

	/* Multi-WAN next-hop support */
	$pconfig['gateway'] = $a_filter[$id]['gateway'];
	
	/* Shaper support */
	$pconfig['defaultqueue'] = $a_filter[$id]['defaultqueue'];
	$pconfig['ackqueue'] = $a_filter[$id]['ackqueue'];
	$pconfig['dnpipe'] = $a_filter[$id]['dnpipe'];
	$pconfig['pdnpipe'] = $a_filter[$id]['pdnpipe'];
	$pconfig['l7container'] = $a_filter[$id]['l7container'];

    //schedule support
    sscanf($pconfig['sched'], "%[0-9]:%[0-9]-%[0-9]:%[0-9]", $pconfig['start_hour'], $pconfig['start_min'], $pconfig['end_hour'], $pconfig['end_min']);

} else {
	/* defaults */
	if ($_GET['if'])
		$pconfig['interface'] = $_GET['if'];
	$pconfig['type'] = "block";
	$pconfig['src'] = "any";
	$pconfig['dst'] = "any";
}
/* Allow the FlotingRules to work */
$if = $pconfig['interface'];

if (isset($_GET['dup']))
	unset($id);

if ($_POST) {

	if ($_POST['type'] == "reject" && $_POST['proto'] <> "tcp")
		$input_errors[] = "只有协议为TCP时才能使用拒绝操作。";

	if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp")) {
		$_POST['srcbeginport'] = 0;
		$_POST['srcendport'] = 0;
		$_POST['dstbeginport'] = 0;
		$_POST['dstendport'] = 0;
	} else {

		if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
			$_POST['srcbeginport'] = $_POST['srcbeginport_cust'];
		if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
			$_POST['srcendport'] = $_POST['srcendport_cust'];

		if ($_POST['srcbeginport'] == "any") {
			$_POST['srcbeginport'] = 0;
			$_POST['srcendport'] = 0;
		} else {
			if (!$_POST['srcendport'])
				$_POST['srcendport'] = $_POST['srcbeginport'];
		}
		if ($_POST['srcendport'] == "any")
			$_POST['srcendport'] = $_POST['srcbeginport'];

		if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
			$_POST['dstbeginport'] = $_POST['dstbeginport_cust'];
		if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
			$_POST['dstendport'] = $_POST['dstendport_cust'];

		if ($_POST['dstbeginport'] == "any") {
			$_POST['dstbeginport'] = 0;
			$_POST['dstendport'] = 0;
		} else {
			if (!$_POST['dstendport'])
				$_POST['dstendport'] = $_POST['dstbeginport'];
		}
		if ($_POST['dstendport'] == "any")
			$_POST['dstendport'] = $_POST['dstbeginport'];
	}

	if (is_specialnet($_POST['srctype'])) {
		$_POST['src'] = $_POST['srctype'];
		$_POST['srcmask'] = 0;
	} else if ($_POST['srctype'] == "single") {
		$_POST['srcmask'] = 32;
	}
	if (is_specialnet($_POST['dsttype'])) {
		$_POST['dst'] = $_POST['dsttype'];
		$_POST['dstmask'] = 0;
	}  else if ($_POST['dsttype'] == "single") {
		$_POST['dstmask'] = 32;
	}

	unset($input_errors);
	$pconfig = $_POST;

	/*  run through $_POST items encoding HTML entties so that the user
	 *  cannot think he is slick and perform a XSS attack on the unwilling 
	 */
//	foreach ($_POST as $key => $value) {
//		$temp = $value;
//		if (isset($_POST['floating']) && $key == "interface")
//			continue;
//		$newpost = htmlentities($temp);
//		if($newpost <> $temp)   	 
//			$input_errors[] = "检测到无效字符 ($temp)。请删除无效字符并重新保存。";		
//	}

	/* input validation */
	$reqdfields = explode(" ", "type proto src dst");
	$reqdfieldsn = explode(",", "操作,协议,源地址,目的地址");

	if($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") {
		if( $_POST['proto'] != "tcp" )
			$input_errors[] = "{$_POST['statetype']} is only valid with protocol tcp.";
		if(($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != ""))
			$input_errors[] = "{$_POST['statetype']} is only valid if the gateway is set to 'default'.";
	}
        
	if (!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) {
		$reqdfields[] = "srcmask";
		$reqdfieldsn[] = "源地址子网掩码";
	}
	if (!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single"))) {
		$reqdfields[] = "dstmask";
		$reqdfieldsn[] = "目的地址子网掩码";
	}

	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);

	if (!$_POST['srcbeginport']) {
		$_POST['srcbeginport'] = 0;
		$_POST['srcendport'] = 0;
	}
	if (!$_POST['dstbeginport']) {
		$_POST['dstbeginport'] = 0;
		$_POST['dstendport'] = 0;
	}

	if (($_POST['srcbeginport'] && !alias_expand($_POST['srcbeginport']) && !is_port($_POST['srcbeginport']))) {
		$input_errors[] = "起始端口必须是别名或者在 1 和 65535 之间。";
	}
	if (($_POST['srcendport'] && !alias_expand($_POST['srcendport']) && !is_port($_POST['srcendport']))) {
		$input_errors[] = "结束端口必须是别名或者在 1 和 65535 之间。";
	}
	if (($_POST['dstbeginport'] && !alias_expand($_POST['dstbeginport']) && !is_port($_POST['dstbeginport']))) {
		$input_errors[] = "起始目的端口必须是别名或者在 1 和 65535 之间。";
	}
	if (($_POST['dstendport'] && !alias_expand($_POST['dstbeginport']) && !is_port($_POST['dstendport']))) {
		$input_errors[] = "结束目的端口必须是别名或者在 1 和 65535 之间。";
	}

	/* if user enters an alias and selects "network" then disallow. */
	if($_POST['srctype'] == "network") {
		if(is_alias($_POST['src']))
			$input_errors[] = "源地址不是有效的网段。";
	}
	if($_POST['dsttype'] == "network") {
		if(is_alias($_POST['dst']))
			$input_errors[] = "目的地址不是有效的网段。";
	}

	if (!is_specialnet($_POST['srctype'])) {
		if (($_POST['src'] && !is_ipaddroranyalias($_POST['src']))) {
			$input_errors[] = "请输入有效IP地址或别名做为源地址。";
		}
		if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
			$input_errors[] = "请输入有效的源地址子网掩码。";
		}
	}
	if (!is_specialnet($_POST['dsttype'])) {
		if (($_POST['dst'] && !is_ipaddroranyalias($_POST['dst']))) {
			$input_errors[] = "请输入有效IP地址或别名做为目的地址。";
		}
		if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
			$input_errors[] = "请输入有效的目的地址子网掩码。";
		}
	}

	if ($_POST['srcbeginport'] > $_POST['srcendport']) {
		/* swap */
		$tmp = $_POST['srcendport'];
		$_POST['srcendport'] = $_POST['srcbeginport'];
		$_POST['srcbeginport'] = $tmp;
	}
	if ($_POST['dstbeginport'] > $_POST['dstendport']) {
		/* swap */
		$tmp = $_POST['dstendport'];
		$_POST['dstendport'] = $_POST['dstbeginport'];
		$_POST['dstbeginport'] = $tmp;
	}
	if ($_POST['os'])
		if( $_POST['proto'] != "tcp" )
			$input_errors[] = "OS detection is only valid with protocol tcp.";

	if ($_POST['ackqueue'] && $_POST['ackqueue'] != "none") {
		if ($_POST['defaultqueue'] == "none" )
			$input_errors[] = "You have to select a queue when you select an acknowledge queue too.";
		else if ($_POST['ackqueue'] == $_POST['defaultqueue'])
			$input_errors[] = "Acknowledge queue and Queue cannot be the same.";		
	}
	if ($_POST['pdnpipe'] && $_POST['pdnpipe'] != "none") {
		if ($_POST['dnpipe'] == "none" )
			$input_errors[] = "You must select a queue for the In direction before selecting one for Out too.";
		else if ($_POST['pdnpipe'] == $_POST['dnpipe'])
			$input_errors[] = "In and Out Queue cannot be the same.";
		else if ($pdnpipe[0] == "?" && $dnpipe[0] <> "?")
			$input_errors[] = "You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.";
		else if ($dnpipe[0] == "?" && $pdnpipe[0] <> "?")
			$input_errors[] = "You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.";
	}
	if($_POST['l7container'] && $_POST['l7container'] != "none") {
		if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp"))
			$input_errors[] = "You can only select a layer7 container for tcp and/or udp protocols";
	}

	if (!$input_errors) {
		$filterent = array();
		$filterent['type'] = $_POST['type'];
		if (isset($_POST['interface'] ))
			$filterent['interface'] = $_POST['interface'];

		if ($if == "FloatingRules" || isset($_POST['floating'])) {
			if (isset($_POST['tag']))
				$filterent['tag'] = $_POST['tag'];
			if (isset($_POST['tagged']))
            			$filterent['tagged'] = $_POST['tagged'];
			$filterent['direction'] = $_POST['direction'];
			if (isset($_POST['quick']) && $_POST['quick'] <> "")
				$filterent['quick'] = $_POST['quick'];
			$filterent['floating'] = "yes";
			if (isset($_POST['interface']) && count($_POST['interface']) > 0)  {
					$filterent['interface'] = implode(",", $_POST['interface']);
			}
		}

		/* Advanced options */
		if ($_POST['allowopts'] == "yes")
			$filterent['allowopts'] = true;
		else
			unset($filterent['allowopts']);
		$filterent['max-src-nodes'] = $_POST['max-src-nodes'];
		$filterent['max-src-states'] = $_POST['max-src-states'];
		$filterent['statetimeout'] = $_POST['statetimeout'];
		$filterent['statetype'] = $_POST['statetype'];
		$filterent['os'] = $_POST['os'];

		/* Nosync directive - do not xmlrpc sync this item */
		if($_POST['nosync'] <> "")
			$filterent['nosync'] = true;
		else
			unset($filterent['nosync']);

		/* unless both values are provided, unset the values - ticket #650 */
		if($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") {
			$filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate'];
			$filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates'];
		} else {
			unset($filterent['max-src-conn-rate']);
			unset($filterent['max-src-conn-rates']);
		}

		if ($_POST['proto'] != "any")
			$filterent['protocol'] = $_POST['proto'];
		else
			unset($filterent['protocol']);

		if ($_POST['proto'] == "icmp" && $_POST['icmptype'])
			$filterent['icmptype'] = $_POST['icmptype'];
		else
			unset($filterent['icmptype']);

		pconfig_to_address($filterent['source'], $_POST['src'],
			$_POST['srcmask'], $_POST['srcnot'],
			$_POST['srcbeginport'], $_POST['srcendport']);

		pconfig_to_address($filterent['destination'], $_POST['dst'],
			$_POST['dstmask'], $_POST['dstnot'],
			$_POST['dstbeginport'], $_POST['dstendport']);

                if ($_POST['disabled'])
                        $filterent['disabled'] = true;
                else
                        unset($filterent['disabled']);
		
		if ($_POST['dscp'])
			$filterent['dscp'] = $_POST['dscp'];

                if ($_POST['log'])
                        $filterent['log'] = true;
                else
                        unset($filterent['log']);
		//strncpy($filterent['descr'], $_POST['descr'], 52);
		$filterent['descr'] = mb_substr($_POST['descr'], 0, 60, 'utf-8');

		if ($_POST['gateway'] != "") {
			$filterent['gateway'] = $_POST['gateway'];
		}
		
		if (isset($_POST['defaultqueue']) && $_POST['defaultqueue'] != "none") {
			$filterent['defaultqueue'] = $_POST['defaultqueue'];
			if (isset($_POST['ackqueue']) && $_POST['ackqueue'] != "none")
				$filterent['ackqueue'] = $_POST['ackqueue'];
		}

		if (isset($_POST['dnpipe']) && $_POST['dnpipe'] != "none") {
			$filterent['dnpipe'] = $_POST['dnpipe'];
			if (isset($_POST['pdnpipe']) && $_POST['pdnpipe'] != "none")
				$filterent['pdnpipe'] = $_POST['pdnpipe'];
		}

		if (isset($_POST['l7container']) && $_POST['l7container'] != "none") {
			$filterent['l7container'] = $_POST['l7container'];
		}
		
	    if(isset($_POST['start_hour']) && isset($_POST['start_min']) && isset($_POST['end_hour']) && isset($_POST['end_min']))
        {
            $filterent['sched'] = sprintf("%s:%s-%s:%s", $_POST['start_hour'], $_POST['start_min'], $_POST['end_hour'], $_POST['end_min']);
        }

		if (isset($id) && $a_filter[$id])
			$a_filter[$id] = $filterent;
		else {
			if (is_numeric($after))
				array_splice($a_filter, $after+1, 0, array($filterent));
			else
				$a_filter[] = $filterent;
		}

		write_config();
		touch($d_filterconfdirty_path);

		if (isset($_POST['floating']))
			header("Location: firewall_rules.php?if=FloatingRules");
		else
			header("Location: firewall_rules.php?if=" . $_POST['interface']);
		exit;
	}
}

read_altq_config(); /* XXX: */
$qlist =& get_unique_queue_list();
read_dummynet_config(); /* XXX: */
$dnqlist =& get_unique_dnqueue_list();
read_layer7_config();
$l7clist =& get_l7_unique_list();

$pgtitle = array("防火墙","规则管理","编辑");
$pgmenu = array('firewall', '/firewall_rules.php');
$closehead = false;

$page_filename = "firewall_rules_edit.php";
include("head.inc");

?>

</head>

<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
<?php include("fbegin.inc"); ?>
<?php if ($input_errors) print_input_errors($input_errors); ?>

<form action="firewall_rules_edit.php" method="post" name="iform" id="iform">
	<table width="100%" border="0" cellpadding="6" cellspacing="0">
		<tr>
			<td colspan="2" valign="top" class="listtopic">防火墙规则编辑</td>
		</tr>	
    	<tr>
			<td width="22%" valign="top" class="vncellreq">操作</td>
			<td width="78%" class="vtable">
				<select name="type" class="formselect">
					<?php $types = explode(" ", "Pass Block Reject"); foreach ($types as $type): ?>
					<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['type'])) echo "selected"; ?>>
					<?=htmlspecialchars($lang[strtolower($type)]);?>
					</option>
					<?php endforeach; ?>
				</select>
				<br/>
				<span class="vexpl">
					选择对匹配该规则的数据包所做的操作。<br/>
					提示：阻止和拒绝的区别在于拒绝包会通知发送者而组织不会。拒绝只适用于TCP和UDP协议。
				</span>
			</td>
		</tr>
		<tr>
			<td width="22%" valign="top" class="vncellreq">是否禁用</td>
			<td width="78%" class="vtable">
				<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>>
				<strong>禁用该规则</strong><br />
				<span class="vexpl">选中该选项使当前规则无效。</span>
			</td>
		</tr>
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
		<tr>
                        <td width="22%" valign="top" class="vncellreq"><?=gettext("Quick");?></td>
                        <td width="78%" class="vtable">
                                <input name="quick" type="checkbox" id="quick" value="yes" <?php if ($pconfig['quick']) echo "checked=\"checked\""; ?> />
                                <strong><?=gettext("Apply the action immediately on match.");?></strong><br />
                                <span class="vexpl"><?=gettext("Set this option if you need to apply this action to traffic that matches this rule immediately.");?></span>
                        </td>
                </tr>
<? endif; ?>
		<tr>
			<td width="22%" valign="top" class="vncellreq">接口</td>
			<td width="78%" class="vtable">
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
				<select name="interface[]" multiple="true" class="formselect" size="3">
<? else: ?>
				<select name="interface" class="formselect">
<?php
   endif;
				$ifdescs = get_configured_interface_with_descr();

				foreach ($ifdescs as $ifent => $ifdesc)
        				if(have_ruleint_access($ifent))
                				$interfaces[$ifent] = $ifdesc;

					if ($config['l2tp']['mode'] == "server")
                                                if(have_ruleint_access("l2tp"))
                                                        $interfaces['l2tp'] = "L2TP VPN";

					if ($config['pptpd']['mode'] == "server")
						if(have_ruleint_access("pptp")) 
							$interfaces['pptp'] = "PPTP VPN";
					
					if ($config['pppoe']['mode'] == "server")
						if(have_ruleint_access("pppoe")) 
							$interfaces['pppoe'] = "PPPoE VPN";
					
					/* add ipsec interfaces */
					if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
						if(have_ruleint_access("enc0")) 
							$interfaces["enc0"] = "IPsec";
		
					/* add openvpn/tun interfaces */
					if  ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
       					$interfaces["openvpn"] = "OpenVPN";

					/* add group interfaces */
					if (is_array($config['ifgroups']['ifgroupentry']))
						foreach($config['ifgroups']['ifgroupentry'] as $ifgen)
							if (have_ruleint_access($ifgen['ifname']))
								$interfaces[$ifgen['ifname']] = $ifgen['ifname'];

					foreach ($interfaces as $iface => $ifacename): ?>
						<option value="<?=$iface;?>" <?php if ($pconfig['interface'] <> "" && stristr($pconfig['interface'], $iface)) echo "selected"; ?>><?=gettext($ifacename);?></option>
<?php 				endforeach; ?>
				</select>
				<br />
				<span class="vexpl">选择匹配该规则的接口。</span>
			</td>
		</tr>
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
                <tr>
                        <td width="22%" valign="top" class="vncellreq"><?=gettext("Direction");?></td>
                        <td width="78%" class="vtable">
                                 <select name="direction" class="formselect">
                                  <?php      $directions = array('any', 'in', 'out');
                                        foreach ($directions as $direction): ?>
                                                <option value="<?=$direction;?>"
                                                <?php if ($direction == $pconfig['direction']): ?>
                                                        selected="selected" 
						<?php endif; ?>
                                                ><?=$direction;?></option>
                  	                <?php endforeach; ?>      
                                </select>
                		<input type="hidden" id="floating" name="floating" value="floating">
                        </td>
                <tr>
<?php endif; ?>
		<tr>
			<td width="22%" valign="top" class="vncellreq">协议</td>
			<td width="78%" class="vtable">
				<select name="proto" class="formselect" onchange="proto_change()">
<?php
				$protocols = explode(" ", "TCP UDP TCP/UDP ICMP");
				foreach ($protocols as $proto): ?>
					<option value="<?=strtolower($proto);?>" <?php if (strtolower($proto) == $pconfig['proto']) echo "selected"; ?>><?=htmlspecialchars($proto);?></option>
<?php 			endforeach; ?>
				</select>
				<br />
				<span class="vexpl">选择该规则需要匹配的协议。<br /> 提示：大多数情况您可能需要选择<em>TCP</em> &nbsp;。</span>
			</td>
		</tr>
		<tr>
			<td width="22%" valign="top" class="vncellreq">源地址</td>
			<td width="78%" class="vtable">
				<input name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
				<strong>取反</strong>
				<br />
				<table border="0" cellspacing="0" cellpadding="0">
					<tr>
						<td>类型：&nbsp;&nbsp;</td>
						<td>
							<select name="srctype" class="formselect" onChange="typesel_change()">
<?php
								$sel = is_specialnet($pconfig['src']); ?>
								<option value="any"     <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>>any</option>
								<option value="single"  <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
								<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
								<?php if(have_ruleint_access("wan")): ?>
								<option value="wanip" 	<?php if ($pconfig['src'] == "wanip") { echo "selected"; } ?>>WAN address</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("lan")): ?>
								<option value="lanip" 	<?php if ($pconfig['src'] == "lanip") { echo "selected"; } ?>>LAN address</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("lan")): ?>
								<option value="lan"     <?php if ($pconfig['src'] == "lan") { echo "selected"; } ?>>LAN subnet</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("pptp")): ?>
								<option value="pptp"    <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("pppoe")): ?>
								<option value="pppoe"   <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
								<?php endif; ?>								
<!--<?php
								$ifdisp = get_configured_interface_with_descr();
								foreach ($ifdisp as $ifent => $ifdesc): ?>
								<?php if(have_ruleint_access($ifent)): ?>
									<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
									<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] ==  $ifent . "ip") { echo "selected"; } ?>>
										<?=$ifdesc?> address
									</option>
								<?php endif; ?>
<?php 							endforeach; ?>-->
							</select>
						</td>
					</tr>
					<tr>
						<td>地址：&nbsp;&nbsp;</td>
						<td>
							<input autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
							<select name="srcmask" class="formselect" id="srcmask">
<?php						for ($i = 31; $i > 0; $i--): ?>
								<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
<?php 						endfor; ?>
							</select>
						</td>
					</tr>
				</table>
			</td>
		</tr>
		<tr id="sprtable" name="sprtable">
			<td width="22%" valign="top" class="vncellreq">源端口</td>
			<td width="78%" class="vtable">
				<table border="0" cellspacing="0" cellpadding="0">
					<tr>
						<td>from:&nbsp;&nbsp;</td>
						<td>
							<select name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
								<option value="">(other)</option>
								<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php 							endforeach; ?>
							</select>
							<input autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo $pconfig['srcbeginport']; ?>">
						</td>
					</tr>
					<tr>
						<td>to:</td>
						<td>
							<select name="srcendport" class="formselect" onchange="ext_change()">
								<option value="">(other)</option>
								<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php							endforeach; ?>
							</select>
							<input autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo $pconfig['srcendport']; ?>">
						</td>
					</tr>
				</table>
				<span class="vexpl">填写源地址的端口或端口范围。<br /> 提示：在<em>'to'</em>字段留空如果你想指定单个端口。</span><br/>
				<span class="vexpl"><B>注意：</B> 您99.99999%的可能不需要设置这个字段，如果您不确认，请不要随意设置。</span>
			</td>
		</tr>
		<tr>
			<td width="22%" valign="top" class="vncellreq">目的地址</td>
			<td width="78%" class="vtable">
				<input name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>>
				<strong>取反</strong>
					<br />
				<table border="0" cellspacing="0" cellpadding="0">
					<tr>
						<td>类型：&nbsp;&nbsp;</td>
						<td>
							<select name="dsttype" class="formselect" onChange="typesel_change()">
<?php
								$sel = is_specialnet($pconfig['dst']); ?>
								<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>>any</option>
								<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
								<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
								<?php if(have_ruleint_access("wan")): ?>
								<option value="wanip" <?php if ($pconfig['dst'] == "wanip") { echo "selected"; } ?>>WAN address</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("lan")): ?>
								<option value="lanip" <?php if ($pconfig['dst'] == "lanip") { echo "selected"; } ?>>LAN address</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("lan")): ?>
								<option value="lan" <?php if ($pconfig['dst'] == "lan") { echo "selected"; } ?>>LAN subnet</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("pptp")): ?>
								<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
								<?php endif; ?>
								<?php if(have_ruleint_access("pppoe")): ?>
								<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
								<?php endif; ?>								
								

<!--<?php 							foreach ($ifdisp as $if => $ifdesc): ?>
								<?php if(have_ruleint_access($if)): ?>
									<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
									<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
										<?=$ifdesc;?> address
									</option>
								<?php endif; ?>
<?php 							endforeach; ?>-->
							</select>
						</td>
					</tr>
					<tr>
						<td>地址：&nbsp;&nbsp;</td>
						<td>
							<input name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>">
							/
							<select name="dstmask" class="formselect" id="dstmask">
<?php
							for ($i = 31; $i > 0; $i--): ?>
								<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option>
<?php						endfor; ?>
							</select>
						</td>
					</tr>
				</table>

			</td>
		</tr>
		<tr id="dprtr" name="dprtr">
			<td width="22%" valign="top" class="vncellreq">目的端口</td>
			<td width="78%" class="vtable">
				<table border="0" cellspacing="0" cellpadding="0">
					<tr>
						<td>from:&nbsp;&nbsp;</td>
						<td>
							<select name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
								<option value="">(other)</option>
								<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
<?php 							endforeach; ?>
							</select>
							<input autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo $pconfig['dstbeginport']; ?>">
						</td>
					</tr>
					<tr>
						<td>to:</td>
						<td>
							<select name="dstendport" class="formselect" onchange="ext_change()">
								<option value="">(other)</option>
								<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php 							endforeach; ?>
							</select>
							<input autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo $pconfig['dstendport']; ?>">
						</td>
					</tr>
				</table>
				<br />
				<span class="vexpl">
				    填写目的地址的端口或端口范围。<br />
				    提示：在<em>'to'</em>字段留空如果你想指定单个端口。
				</span>
			</td>
		</tr>
        <tr>
            <td width="22%" valign="top" class="vncellreq">连接数限制</td>
            <td width="78%" class="vtable">
                <input name="max-src-states" id="max-src-states" value="<?php echo $pconfig['max-src-states'] ?>"> 单IP最大连接数<br> 
                <input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo $pconfig['max-src-conn-rate'] ?>"> 每
                <select name="max-src-conn-rates" id="max-src-conn-rates">
                    <option value=""<?php if(intval($pconfig['max-src-conn-rates']) < 1) echo " selected"; ?>></option>
<?php               for($x=1; $x<255; $x++) {
                        if($x == $pconfig['max-src-conn-rates']) $selected = " selected"; else $selected = "";
                        echo "<option value=\"{$x}\"{$selected}>{$x}</option>\n";
                    } ?>
                </select> 秒 新建连接数
            </td>
        </tr>
        <tr>
            <td width="22%" valign="top" class="vncellreq">生效时间</td>
            <td width="78%" class="vtable">
                <select name="start_hour">
                    <option value="00" <?php if($pconfig['start_hour'] == "00") echo "selected";?>>00</option>
                    <option value="01" <?php if($pconfig['start_hour'] == "01") echo "selected";?>>01</option>
                    <option value="02" <?php if($pconfig['start_hour'] == "02") echo "selected";?>>02</option>
                    <option value="03" <?php if($pconfig['start_hour'] == "03") echo "selected";?>>03</option>
                    <option value="04" <?php if($pconfig['start_hour'] == "04") echo "selected";?>>04</option>
                    <option value="05" <?php if($pconfig['start_hour'] == "05") echo "selected";?>>05</option>
                    <option value="06" <?php if($pconfig['start_hour'] == "06") echo "selected";?>>06</option>
                    <option value="07" <?php if($pconfig['start_hour'] == "07") echo "selected";?>>07</option>
                    <option value="08" <?php if($pconfig['start_hour'] == "08") echo "selected";?>>08</option>
                    <option value="09" <?php if($pconfig['start_hour'] == "09") echo "selected";?>>09</option>
                    <option value="10" <?php if($pconfig['start_hour'] == "10") echo "selected";?>>10</option>
                    <option value="11" <?php if($pconfig['start_hour'] == "11") echo "selected";?>>11</option>
                    <option value="12" <?php if($pconfig['start_hour'] == "12") echo "selected";?>>12</option>
                    <option value="13" <?php if($pconfig['start_hour'] == "13") echo "selected";?>>13</option>
                    <option value="14" <?php if($pconfig['start_hour'] == "14") echo "selected";?>>14</option>
                    <option value="15" <?php if($pconfig['start_hour'] == "15") echo "selected";?>>15</option>
                    <option value="16" <?php if($pconfig['start_hour'] == "16") echo "selected";?>>16</option>
                    <option value="17" <?php if($pconfig['start_hour'] == "17") echo "selected";?>>17</option>
                    <option value="18" <?php if($pconfig['start_hour'] == "18") echo "selected";?>>18</option>
                    <option value="19" <?php if($pconfig['start_hour'] == "19") echo "selected";?>>19</option>
                    <option value="20" <?php if($pconfig['start_hour'] == "20") echo "selected";?>>20</option>
                    <option value="21" <?php if($pconfig['start_hour'] == "21") echo "selected";?>>21</option>
                    <option value="22" <?php if($pconfig['start_hour'] == "22") echo "selected";?>>22</option>
                    <option value="23" <?php if($pconfig['start_hour'] == "23") echo "selected";?>>23</option>
                </select>
                时
                <select name="start_min">
                    <option value="00" <?php if($pconfig['start_min'] == "00") echo "selected";?>>00</option>
                    <option value="15" <?php if($pconfig['start_min'] == "15") echo "selected";?>>15</option>
                    <option value="30" <?php if($pconfig['start_min'] == "30") echo "selected";?>>30</option>
                    <option value="45" <?php if($pconfig['start_min'] == "45") echo "selected";?>>45</option>
                    <option value="59" <?php if($pconfig['start_min'] == "59") echo "selected";?>>59</option>
                </select>
                分
                -
                <select name="end_hour">
                    <option value="00" <?php if($pconfig['end_hour'] == "00") echo "selected";?>>00</option>
                    <option value="01" <?php if($pconfig['end_hour'] == "01") echo "selected";?>>01</option>
                    <option value="02" <?php if($pconfig['end_hour'] == "02") echo "selected";?>>02</option>
                    <option value="03" <?php if($pconfig['end_hour'] == "03") echo "selected";?>>03</option>
                    <option value="04" <?php if($pconfig['end_hour'] == "04") echo "selected";?>>04</option>
                    <option value="05" <?php if($pconfig['end_hour'] == "05") echo "selected";?>>05</option>
                    <option value="06" <?php if($pconfig['end_hour'] == "06") echo "selected";?>>06</option>
                    <option value="07" <?php if($pconfig['end_hour'] == "07") echo "selected";?>>07</option>
                    <option value="08" <?php if($pconfig['end_hour'] == "08") echo "selected";?>>08</option>
                    <option value="09" <?php if($pconfig['end_hour'] == "09") echo "selected";?>>09</option>
                    <option value="10" <?php if($pconfig['end_hour'] == "10") echo "selected";?>>10</option>
                    <option value="11" <?php if($pconfig['end_hour'] == "11") echo "selected";?>>11</option>
                    <option value="12" <?php if($pconfig['end_hour'] == "12") echo "selected";?>>12</option>
                    <option value="13" <?php if($pconfig['end_hour'] == "13") echo "selected";?>>13</option>
                    <option value="14" <?php if($pconfig['end_hour'] == "14") echo "selected";?>>14</option>
                    <option value="15" <?php if($pconfig['end_hour'] == "15") echo "selected";?>>15</option>
                    <option value="16" <?php if($pconfig['end_hour'] == "16") echo "selected";?>>16</option>
                    <option value="17" <?php if($pconfig['end_hour'] == "17") echo "selected";?>>17</option>
                    <option value="18" <?php if($pconfig['end_hour'] == "18") echo "selected";?>>18</option>
                    <option value="19" <?php if($pconfig['end_hour'] == "19") echo "selected";?>>19</option>
                    <option value="20" <?php if($pconfig['end_hour'] == "20") echo "selected";?>>20</option>
                    <option value="21" <?php if($pconfig['end_hour'] == "21") echo "selected";?>>21</option>
                    <option value="22" <?php if($pconfig['end_hour'] == "22") echo "selected";?>>22</option>
                    <option value="23" <?php if($pconfig['end_hour'] == "23" || $pconfig['end_hour'] == "") echo "selected";?>>23</option>
                </select>
                时
                <select name="end_min">
                    <option value="00" <?php if($pconfig['end_min'] == "00") echo "selected";?>>00</option>
                    <option value="15" <?php if($pconfig['end_min'] == "15") echo "selected";?>>15</option>
                    <option value="30" <?php if($pconfig['end_min'] == "30") echo "selected";?>>30</option>
                    <option value="45" <?php if($pconfig['end_min'] == "45") echo "selected";?>>45</option>
                    <option value="59" <?php if($pconfig['end_min'] == "59" || $pconfig['end_min'] == "") echo "selected";?>>59</option>
                </select>
                分               
            </td>
        </tr>   
		<tr>
			<td width="22%" valign="top" class="vncellreq">日志</td>
			<td width="78%" class="vtable">
				<input name="log" type="checkbox" id="log" value="yes" <?php if ($pconfig['log']) echo "checked"; ?>>
				<strong>记录匹配该规则的数据包。</strong>
					<br />
				<span class="vexpl">提示：系统存放日志的空间有限，请不要打开过多的日志。如果您需要保存更多的日志，请考虑使用<a href="diag_logs_settings.php">远程日志服务器</a>来保存。</span>
			</td>
		</tr>
		<tr>
			<td width="22%" valign="top" class="vncell">描述</td>
			<td width="78%" class="vtable">
				<input name="descr" type="text" class="formfld unknown" id="descr" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['descr']);?>">
				<br />
				<span class="vexpl">您可以输入一些描述作为参考。</span>
			</td>
		</tr>
		<tr>
			<td width="22%" valign="top">&nbsp;</td>
			<td width="78%">
				<input name="Submit" type="submit" class="formbtn" value="保存">  <input type="button" class="formbtn" value="取消" onclick="history.back()">
<?php			if (isset($id) && $a_filter[$id]): ?>
					<input name="id" type="hidden" value="<?=$id;?>">
<?php 			endif; ?>
				<input name="after" type="hidden" value="<?=$after;?>">
			</td>
		</tr>
	</table>
</form>
<script language="JavaScript">
<!--
	ext_change();
	typesel_change();
	proto_change();

<?php
	$isfirst = 0;
	$aliases = "";
	$addrisfirst = 0;
	$aliasesaddr = "";
	if($config['aliases']['alias'] <> "" and is_array($config['aliases']['alias']))
		foreach($config['aliases']['alias'] as $alias_name) {
			if(!stristr($alias_name['address'], ".")) {
				if($isfirst == 1) $aliases .= ",";
				$aliases .= "'" . $alias_name['name'] . "'";
				$isfirst = 1;
			} else {
				if($addrisfirst == 1) $aliasesaddr .= ",";
				$aliasesaddr .= "'" . $alias_name['name'] . "'";
				$addrisfirst = 1;
			}
		}
?>

	var addressarray=new Array(<?php echo $aliasesaddr; ?>);
	var customarray=new Array(<?php echo $aliases; ?>);

//-->
</script>


<?php include("fend.inc"); ?>
</body>
</html>

